Weaknesses of type CWE-79

29,721 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-46606MEDIUMA cross-site scripting (XSS) vulnerability in the component /admin.php?page=photo of Piwigo v14.5.0 allows attackers to execute arbitrary weEPSS 0.4%CVE-2024-32528HIGHWordPress WP Dynamic Keywords Injector plugin <= 2.3.18 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-15094MEDIUMsunkaifei FlyCMS User Login UserController.java userLogin cross site scriptingEPSS 0.4%CVE-2023-47660MEDIUMWordPress Product Visibility by Country for WooCommerce Plugin <= 1.4.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2022-45361MEDIUMWordPress 0mk Shortener Plugin <= 0.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-30123MEDIUMwuzhicms v4.1.0 is vulnerable to Cross Site Scripting (XSS) in the Member Center, Account Settings.EPSS 0.4%CVE-2023-3476LOWSimplePHPscripts GuestBook Script URL Parameter preview.php cross site scriptingEPSS 0.4%CVE-2023-24398MEDIUMWordPress EZP Coming Soon Page Plugin <= 1.0.7.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-22300HIGHWordPress Icegram Express plugin <= 5.7.11 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-49829MEDIUMWordPress Tutor LMS Plugin <= 2.2.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-3477LOWRocketSoft Rocket LMS Contact Form store cross site scriptingEPSS 0.4%CVE-2024-22299HIGHWordPress FV Player plugin <= 7.5.41.7212 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-49767MEDIUMWordPress Biteship Plugin <= 2.2.24 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2017-20188LOWZimbra zm-ajax XFormItem.js XFormItem.prototype.setError cross site scriptingEPSS 0.4%CVE-2023-47528MEDIUMWordPress WP Edit Username Plugin <= 1.0.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-43999MEDIUMAn issue in COLORFUL_laundry mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel acEPSS 0.4%CVE-2023-25031MEDIUMWordPress Arigato Autoresponder and Newsletter Plugin <= 2.7.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-0376HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.4%CVE-2024-32563HIGHWordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.6.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-25023MEDIUMWordPress WebinarIgnition Plugin <= 2.14.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%